Every tool, program, grant and hardening guide we actually use — vetted, categorised, and free to take. No signup. No mailing list. No pitch.
Most of what an agency charges you to “discover” is sitting in public, behind nothing but the knowledge that it exists. So here it is.
You should be able to check whether your own email is sitting in a breach without paying someone to tell you.
There is six figures of donated software and ad budget available to you. Most of it goes unclaimed because nobody told you it existed.
The same baselines that protect an enterprise are published, free, and written so a team of eight can follow them.
Everything below is provided as-is, with no warranty. We did not build these third-party tools and we do not control them. Hardening scripts, registry edits and security policies can break software, lock you out, or cause data loss.
Take a full backup first. Test on one machine before you touch a fleet. If a change affects systems holding client, patient or payment data, have someone accountable review it — and if that is past your comfort level, that is exactly the moment to ask for help rather than push the button.
Our own instruments. Free to run, and the methodology is published rather than hidden.
Ten questions, about four minutes. Five on how you grow, five on how well that growth holds up — then the gap between the two. Asks for a business name and email so we can send you the result. It is the only thing on this page that asks you for anything.
Run the assessment →Answer eleven questions and find out whether your nonprofit qualifies for the $10,000/month Google Ad Grant — and which of the compliance rules would trip you up in month three.
Coming soonBusiness email compromise is the fraud that actually drains small organisations. Nine questions against the controls that stop it before the wire goes out.
Coming soonIf you hold charitable status, a very large amount of infrastructure is free or near-free to you. Everything Google flows from one verification step — and it is not the one most people expect. Start with Goodstack.
Google’s official validation partner for Google for Nonprofits, and the gatekeeper for Ad Grants. Formerly Percent — and it is not TechSoup, which is where a lot of outdated advice still sends people. Verify here first or the Google application goes nowhere.
goodstack.org → Google for NonprofitsFreeOnce Goodstack has verified you, this one account unlocks Ad Grants, the nonprofit Workspace tier and the YouTube program. Note the exclusions: governments, hospitals and schools are ineligible — though their charitable arms and foundations qualify.
google.com/nonprofits → Google Ad Grants$10k/moTen thousand US dollars of search advertising every month, permanently. The catch is the compliance rules — 5% click-through minimum, active conversion tracking, no single-word keywords — and accounts get suspended for missing those, not for spending badly.
google.com/grants → YouTube Nonprofit ProgramFreeDonation cards directly on your videos, link annotations out to your own site, and access to the creator production spaces. Wildly underused by Canadian charities.
youtube.com/nonprofits → Microsoft for NonprofitsFree tierMicrosoft 365 Business Premium donated for up to 10 users — which matters because Business Premium is the tier that carries Intune, Defender and conditional access. That is a genuine security posture, free.
microsoft.com/nonprofits → TechSoup CanadaCanadianStill the Canadian clearing house for donated and discounted software — Adobe, Autodesk, Bitdefender, Zoom and dozens more at admin-fee pricing. Worth registering with on its own merits. It no longer handles Google validation; that moved to Goodstack.
techsoupcanada.ca → Canva for NonprofitsFreeCanva Pro at no cost for registered charities. Brand kits, background removal and team folders — enough that a small comms team stops needing a design subscription at all.
canva.com → ZeffyCanadianMontreal-built fundraising platform that charges the nonprofit nothing — no transaction fee, no platform cut — by asking donors for an optional tip instead. Read the model and decide whether it fits your donor base, but the zero-fee claim holds up.
zeffy.com → CanadaHelpsCanadianDonation processing, tax receipting and peer-to-peer campaign tooling built specifically for CRA-registered charities. Receipting alone saves a small org a startling number of admin hours.
canadahelps.org → Imagine CanadaSector bodyStandards Program, sector research and governance templates. Where you go when a funder asks what your accountability framework is and you need a real answer.
imaginecanada.ca → Salesforce Nonprofit Cloud10 freeTen donated licences of a genuine enterprise CRM. Be honest about capacity before you take them — Salesforce rewards organisations that can staff it and punishes ones that cannot.
salesforce.org →Classic SEO tools still do the heavy lifting. Answer Engine Optimisation and Generative Engine Optimisation are new enough that the honest answer is that the tooling category barely exists yet — so we have said which is which.
The only source of truth for what Google actually sees on your site. Indexing status, real query data, Core Web Vitals, manual penalties. If you install one thing this week, install this.
search.google.com → Bing Webmaster ToolsFreeHistorically ignored — and now suddenly load-bearing, because Bing’s index feeds Copilot and a meaningful share of AI answer surfaces. Verifying here is a direct AEO move, not a legacy one.
bing.com/webmasters → SEOquakeFreeBrowser extension from Semrush that overlays on-page SEO diagnostics onto any page you visit, including the SERP itself. The fastest way to read a competitor’s structure without opening a single paid tool.
seoquake.com → SpyFuFree previewShows every keyword a competitor has bought and ranked for, going back years. The free preview reveals enough to tell whether a rival’s paid strategy is working before you consider copying it.
spyfu.com → Ahrefs Webmaster ToolsFreeA genuinely generous free tier for sites you can verify ownership of: full backlink profile, site audit, and the keywords you already rank for. Verification is the price of entry.
ahrefs.com → Screaming Frog SEO Spider500 freeDesktop crawler, free up to 500 URLs — which covers most small business sites entirely. Finds broken links, redirect chains, duplicate titles and orphaned pages in about four minutes.
screamingfrog.co.uk → Rich Results TestFreeValidates your structured data against what Google will actually render. Structured data is the closest thing AEO currently has to a lever you can pull deliberately — machines read schema before they read prose.
search.google.com/test → Schema Markup ValidatorFreeThe vendor-neutral validator, run by Schema.org itself. Checks your markup against the spec rather than against one search engine’s subset of it.
validator.schema.org → PageSpeed InsightsFreeLab and real-world field data in one report. Read the field data first — the lab score is a simulation, the field data is your actual visitors on their actual phones.
pagespeed.web.dev → Google Business ProfileFreeFor any organisation with a physical location or service area, this outperforms the website for local intent. Claim it, fill every field, keep the hours accurate — stale hours are a ranking signal and a trust signal at once.
google.com/business →Find out what of yours is already out there. Free, no account needed for the first three — and read the caveat underneath before you trust any “dark web scan” anyone sells you.
The reference implementation. Run by Troy Hunt, catalogues billions of records from disclosed breaches, and partners with the FBI on compromised credential feeds. Type in an address, get an answer, pay nothing.
haveibeenpwned.com → HIBP Domain SearchFree*Checks every address on a domain you control at once — the version that actually matters to an employer. Requires you to prove you own the domain via DNS or a verification mailbox. Small domains are free.
haveibeenpwned.com/DomainSearch → Pwned PasswordsFreeChecks a password against a billion known-compromised ones without ever sending it — it uses k-anonymity, so only the first five characters of the hash leave your browser. Worth understanding, because it is how this should be done.
haveibeenpwned.com/Passwords → Mozilla MonitorFreeFormerly Firefox Monitor. Sits on the same dataset but adds ongoing alerting, so you hear about a future breach rather than having to remember to check. Good for the non-technical people in your life.
monitor.mozilla.org → Canadian Anti-Fraud CentreCanadaWhere a Canadian business or individual actually reports fraud, and where current scam patterns get published. Reporting feels futile in the moment; it is what builds the case data that eventually stops the operation.
antifraudcentre.ca → OPC — Breach ObligationsCanadaUnder PIPEDA, a breach posing real risk of significant harm must be reported to the Privacy Commissioner and to affected individuals — and you must keep records of every breach for two years. Most small businesses do not know that record-keeping duty exists.
priv.gc.ca →Business email compromise is the fraud that actually empties small organisations, and it almost always starts with a domain anyone can spoof. These checks take ten minutes and cost nothing.
One box, every DNS and mail record. MX, SPF, DKIM, DMARC, blacklist status. Start here to see what the rest of the internet currently believes about your domain.
mxtoolbox.com → dmarcian Domain CheckerFreeReads your SPF, DKIM and DMARC and tells you in plain language what they would actually do to a forged message. If your DMARC policy is p=none, you are collecting reports and blocking nothing — most domains never move past that.
Shows how Gmail rates your sending domain — spam rate, reputation, authentication pass rate. If your newsletters quietly stopped landing, this is where the reason is written down.
postmaster.google.com → Internet.nlFreeGovernment-backed Dutch test suite covering modern standards most checkers skip: DNSSEC, TLS configuration, MTA-STS, IPv6. Stricter than the commercial tools, and it does not upsell you.
internet.nl → Mail-TesterFreeSend one real message to the address it gives you and get scored on deliverability out of ten, with every reason listed. The fastest sanity check before a campaign goes out.
mail-tester.com → Qualys SSL LabsFreeThe definitive TLS audit for a public web server. Grades your certificate chain, protocol support and cipher suites A through F. Anything below an A on a site taking form submissions is worth a conversation.
ssllabs.com/ssltest →p=none to p=quarantine once your reports are clean → SSL Labs on the website itself. That sequence closes the specific hole that lets someone email your bookkeeper as you.Start from a published baseline rather than a blog post. CIS and Microsoft both give theirs away — the paid part is the automation, not the knowledge.
The consensus baseline for Windows 11, Server and about a hundred other platforms. Level 1 is safe for most businesses; Level 2 will break things in a normal office. Free to download after a form — you are not buying anything.
cisecurity.org/cis-benchmarks → Security Compliance ToolkitFreeMicrosoft’s own security baselines plus Policy Analyzer, which diffs your live Group Policy against the recommended one and shows exactly what differs. The tool most IT shops do not know exists.
microsoft.com → SysHardenerFree tierNoVirusThanks’ hardening front end — applies sensible restrictions to Office macros, script hosts and living-off-the-land binaries through a checklist instead of a registry editor. It has an undo. Use it.
syshardener.com → OSArmorPaidBehaviour blocking rather than signature matching — it stops the pattern (Word spawning PowerShell, an ISO launching a script) rather than the file. Complements antivirus; does not replace it.
osarmor.com → HardeningKittyOpen sourcePowerShell module that audits a Windows machine against CIS, Microsoft and BSI baselines and scores it. Run it in audit mode first — the report alone is worth the ten minutes.
github.com/scipag/HardeningKitty → Sysinternals SuiteFreeAutoruns shows every persistence point on the machine. Process Explorer shows what is really running and checks it against VirusTotal. Forty tools, all free, all from Microsoft.
learn.microsoft.com/sysinternals →# Open PowerShell as Administrator. Every line below only READS state. # Is the disk actually encrypted? Get-BitLockerVolume | Select-Object MountPoint, VolumeStatus, ProtectionStatus # Is Defender on, updated, and is real-time protection running? Get-MpComputerStatus | Select-Object AMServiceEnabled, RealTimeProtectionEnabled, AntivirusSignatureAge # Firewall on for all three profiles? All three should say True. Get-NetFirewallProfile | Select-Object Name, Enabled # Which local accounts can still log in? Look for ones nobody recognises. Get-LocalUser | Where-Object Enabled -eq $true | Select-Object Name, LastLogon # Who holds local administrator rights on this machine? Get-LocalGroupMember -Group "Administrators"
The serious macOS baseline is a joint NIST, NASA, DISA and Los Alamos project, it is free, and it generates a compliance script tailored to whichever standard you have to answer to. Almost nobody outside government uses it.
The real thing people mean by “military-grade Mac hardening.” Pick your baseline — NIST 800-53, CIS, DISA STIG — and it generates the configuration profiles, audit script and documentation for you. Now covers through macOS 27.
github.com/usnistgov/macos_security → mSCP DocumentationNISTThe readable front door to the project above. Start here if the repository looks intimidating — the walkthrough is written for administrators, not cryptographers.
pages.nist.gov/macos_security → Objective-See ToolsFree & openPatrick Wardle’s suite, all free and open source. LuLu is an outbound firewall, KnockKnock reveals everything persistently installed, BlockBlock alerts the moment something tries to persist, OverSight catches mic and webcam access, RansomWhere? watches for mass encryption.
objective-see.org/tools → Apple Platform SecurityFreeApple’s own documentation of how Secure Enclave, FileVault, Gatekeeper, SIP and the signed system volume actually work. Dense, but it is the source — and it settles a lot of arguments.
support.apple.com/guide/security → CIS Apple macOS BenchmarkFree PDFIf you already run CIS across your Windows estate, this keeps one consistent standard on both. Overlaps heavily with mSCP — pick one as your source of truth rather than running both.
cisecurity.org/benchmark/apple_os → Objective-See on GitHubSourceEvery tool above, source open for inspection. Worth noting for anyone who is — correctly — suspicious of installing a security tool they cannot read.
github.com/objective-see →# Open Terminal. Every line below only READS state. # Is FileVault on? Anything but "FileVault is On." needs attention. fdesetup status # Is System Integrity Protection enabled? Should say "enabled". csrutil status # Is Gatekeeper enforcing? Should say "assessments enabled". spctl --status # Is the application firewall on? 1 or 2 is on, 0 is off. sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate # Which accounts hold admin rights on this Mac? dscl . -read /Groups/admin GroupMembership # Are automatic security updates actually turned on? defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist
The moment you pass roughly five employees, managing laptops by walking over to them stops working. Mobile device management is what lets you prove a policy is applied rather than hope it is.
Free, and the foundation for everything Apple. It is what makes a Mac or iPhone enrol itself into your management the first time it is switched on, and what stops a departing employee keeping a device you paid for. Set this up before you choose an MDM.
business.apple.com → Microsoft IntuneIn M365 BPAlready included in Microsoft 365 Business Premium — which nonprofits get donated for ten users. Manages Windows, macOS, iOS and Android from one console. An enormous number of organisations are already paying for this and have never switched it on.
microsoft.com/intune → MosyleFree tierApple-only MDM with a genuinely free tier covering core device management. For a small all-Mac office this is often the whole answer, at no cost.
mosyle.com → Jamf Now3 freeThe simplified tier of the Apple management standard. First three devices free. Worth knowing as the upgrade path if you outgrow the simpler options.
jamf.com/jamf-now → NIST SP 800-124 Rev. 2NISTGuidelines for Managing the Security of Mobile Devices in the Enterprise. The actual document behind most “MDM best practices” blog posts — free, and clearer than the posts summarising it.
csrc.nist.gov → Apple Platform DeploymentFreeApple’s deployment guide — enrolment, declarative device management, every payload you can push. The reference you keep open while configuring a profile.
support.apple.com/guide/deployment →What to point at when a funder, an insurer or a client asks what standard you work to. All published, all free, all written by people with no product to sell you.
The Canadian Centre for Cyber Security’s baseline controls, written specifically for small and medium organisations. If you read one framework document this year, read this one — it is short, Canadian, and deliberately achievable.
cyber.gc.ca → CyberSecure CanadaCanadaThe federal certification built on those baseline controls. A real, verifiable credential a small Canadian business can earn — and increasingly something larger clients ask about during procurement.
ised-isde.canada.ca → Get Cyber SafeCanadaThe public-facing campaign, with free awareness material you are allowed to reuse. Genuinely useful for staff training when you have no budget for a training platform.
getcybersafe.gc.ca → CIS Critical Security ControlsFreeEighteen controls, ordered by what stops the most attacks for the least effort, and split into implementation groups so a small organisation knows which subset applies to it. The best prioritised list in the field.
cisecurity.org/controls → NIST Cybersecurity FrameworkNISTGovern, Identify, Protect, Detect, Respond, Recover. Not a checklist — a vocabulary, which is what makes it the language insurers and enterprise clients tend to speak. Version 2.0 added Govern, and that addition is the one small organisations most need.
nist.gov/cyberframework → IPC Ontario — PHIPAOntarioIf you hold health information in Ontario — a dental practice, a clinic, a therapy office — you are a health information custodian under PHIPA, and a solo practice carries the same core safeguard duties as a hospital. This is where those duties are written down.
ipc.on.ca →Not everything here is for businesses. These are for households, co-ops, community groups and anyone trying to get online safely without paying for the privilege — Canadian where it matters, universal where it does not.
A free DNS firewall from the non-profit that runs .ca. Blocks malware, phishing and scam sites for the whole household — phone and desktop apps, a browser extension, or set it once on the router and every device is covered. Mozilla made it the default private DNS for Firefox users in Canada. No account, no ads, and CIRA does not sell your data.
cira.ca/en/canadian-shield → Connecting FamiliesCanadaFederal program putting low-cost home internet within reach of households that cannot otherwise afford it, run with participating providers and paired with a refurbished-computer stream. Eligibility is notified directly, so start here to check where you stand rather than assuming you do not qualify.
ised-isde.canada.ca → Canadian Co-op DirectoryFreeEvery co-operative, credit union and mutual insurer in the country on one map — over ten thousand data points. If you would rather your money stayed with a member-owned organisation than a shareholder-owned one, this is how you find the nearest.
canada.coop → Starting a Co-opFreeThe national body’s guide to what a co-operative actually is, how to start one and how to finance it. Worth knowing that this organisation is rebranding to Canada Co-op in October 2026 — same body, new name, so do not be thrown if the logo changes under you.
canada.coop → Find a Credit UnionFreeSearchable map of every credit union branch and ATM in Canada. Member-owned rather than shareholder-owned, which usually shows up as lower fees on the accounts ordinary people actually hold. Several serve Windsor-Essex directly.
ccua.com → CIRA Net Good GrantsFundingCIRA funds community projects that improve Canada’s internet — access in underserved areas, digital literacy, online safety. Real money, and community groups routinely do not know it exists. If you run a community organisation with a digital project, read the criteria.
cira.ca/en/grants → BitwardenFree tierOpen-source password manager with a free tier that genuinely covers one person — unlimited passwords, unlimited devices, no upsell wall in the middle. The single highest-value thing most households can change this week, and it costs nothing.
bitwarden.com → SignalFreeEnd-to-end encrypted messaging run by a non-profit foundation, funded by donations rather than advertising. No data to mine because there is no business model that needs it.
signal.org → LibreOfficeFreeA full office suite — documents, spreadsheets, presentations — that opens and saves Microsoft formats and costs nothing, forever. For a community group, a student or a household on a budget, this removes a recurring subscription outright.
libreoffice.org →Two one-page PDFs we wrote for our own client work. Print them, ignore the logo, use them. No form in front of either.
The verification steps that stop a fraudulent wire before it leaves. Built around the scenario that actually happens: a convincing email, a changed bank detail, and nobody who feels they have the authority to say wait.
Download PDF → Staff Offboarding ChecklistPDFEvery account, key, device and shared credential that needs closing on someone’s last day. Orphaned access from departed staff is one of the quietest and most common ways small organisations get hurt.
Download PDF →Code we run on our own sites. Each one says what it does and why — because pasting code you do not understand into a live site is how sites break.
Before you paste anything below: take a full backup, and add it through a code-snippets plugin or a child theme — never by editing a parent theme’s functions.php, which the next update will overwrite. A syntax error here takes the whole site down, not just one page. If you have no way to restore, stop.
/* Add ABOVE the line that says "That's all, stop editing!" */ // Blocks the built-in theme and plugin file editors. If an attacker // gets an admin session, this removes their easiest way to run code. define( 'DISALLOW_FILE_EDIT', true ); // Forces the login and admin area over HTTPS. define( 'FORCE_SSL_ADMIN', true ); // Keeps 5 revisions per post instead of unlimited. A database-size // decision rather than a security one, but it matters on older sites. define( 'WP_POST_REVISIONS', 5 ); // Empties trash after 14 days rather than 30. define( 'EMPTY_TRASH_DAYS', 14 );
DISALLOW_FILE_EDIT is the highest-value line on this page. It costs you nothing you actually use — and it closes the path most commonly used to turn a stolen admin password into a permanent backdoor.add_action( 'send_headers', function() { // Stops your site being framed inside someone else's page, // which is how clickjacking works. header( 'X-Frame-Options: SAMEORIGIN' ); // Stops browsers guessing a file is a different type than you said. header( 'X-Content-Type-Options: nosniff' ); // Stops your URLs leaking to third-party sites in the referer. header( 'Referrer-Policy: strict-origin-when-cross-origin' ); // Switches off browser APIs you almost certainly do not use. header( 'Permissions-Policy: geolocation=(), microphone=(), camera=()' ); } );
securityheaders.com. If your site legitimately embeds itself somewhere — a booking widget inside a partner’s page — the first line will break that, so test before you ship it.// Turns off XML-RPC, the legacy remote API. Brute-force tools love it // because it lets them try many passwords in a single request. // LEAVE THIS OUT if you use Jetpack or the WordPress mobile apps. add_filter( 'xmlrpc_enabled', '__return_false' ); // Blocks /?author=1 , which otherwise hands out real usernames. add_action( 'template_redirect', function() { if ( is_author() && ! is_user_logged_in() ) { wp_safe_redirect( home_url(), 301 ); exit; } } ); // Makes failed logins say the same thing whether or not the username // was real. The default message confirms which half you got right. add_filter( 'login_errors', function() { return 'Those details did not work. Please try again.'; } );
Nothing on this page is a secret, and almost none of it was ours to begin with. Every link here is public, free, and has been the whole time — what most organisations are missing is not access, it is someone who knows which four of these forty actually apply to you, in what order, and what breaks if you get the sequence wrong.
That is the entire difference between a list and a plan. If the list is enough for you, take it and go — that is a good outcome and you owe us nothing. If you would rather not work out the order alone, that is the part we do.
Redefine LogicWe help small businesses, nonprofits and co-ops grow safely — marketing that brings people in, security that protects what you build.
© 2026 Redefine Logic Media™. All rights reserved.
Redefine Logic Mediaâ„¢ is committed to making this website usable by as many people as possible, regardless of ability or the technology they browse with. We treat accessibility as ongoing work rather than a one-time task.
We aim to meet the Web Content Accessibility Guidelines (WCAG) 2.2 at Level AA. We test with keyboard-only navigation, screen readers and automated tooling, and we fix issues as we find them. We are not claiming full conformance across every page — where we fall short, we want to know.
This site includes an accessibility toolbar that lets you adjust the page to suit how you read and navigate. It changes only how the page is presented in your browser; it does not send your choices anywhere, and it does not replace the underlying accessible markup of the site.
The toolbar can:
This site is built to work with screen readers such as NVDA, JAWS, VoiceOver and TalkBack, and to be fully operable with a keyboard alone. If you use assistive technology and something does not work as expected, that is a bug on our side, not yours — please tell us.
Some third-party content — embedded maps, videos, payment forms and social feeds — is outside our direct control and may not meet the same standard. Where we can, we provide an accessible alternative. Where we cannot, we will help you get the same information another way.
If you hit something on this site you cannot use, please get in touch through the contact details on this site. Tell us the page and what went wrong, and we will respond and work with you on an accessible alternative.
Accessibility toolbar by Redefine Logic Media.